Overview

overview

10

Static

static

3

f764f402a0...2N.exe

windows7-x64

10

f764f402a0...2N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f764f402a05197a4239241a3bc2954c3f2d7226228a49c49486238121b49e512N

  • Size

    95KB

  • Sample

    241012-jqbbysvfpn

  • MD5

    892b55d1ce4965de427a02587f288280

  • SHA1

    dd9e4f6df1618867a471f4e4efe766ae48135091

  • SHA256

    f764f402a05197a4239241a3bc2954c3f2d7226228a49c49486238121b49e512

  • SHA512

    ca55bb54e08969db85907feb44009af6859451917145e7f045d1b1cae819b0baa1a01b814a339815350796b52667696fc3da9e0bfaaef792e5eb2d9419d8ed3d

  • SSDEEP

    1536:vKQj+0uJJEVGakj3b0wl+60U7CPIWMiFI3WEf3h6QzxjeRQrnRVRoRch1dROrwp+:SQC0uJJEVGamrrl/NHWPEfR6QIerTWMa

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f764f402a05197a4239241a3bc2954c3f2d7226228a49c49486238121b49e512N

    • Size

      95KB

    • MD5

      892b55d1ce4965de427a02587f288280

    • SHA1

      dd9e4f6df1618867a471f4e4efe766ae48135091

    • SHA256

      f764f402a05197a4239241a3bc2954c3f2d7226228a49c49486238121b49e512

    • SHA512

      ca55bb54e08969db85907feb44009af6859451917145e7f045d1b1cae819b0baa1a01b814a339815350796b52667696fc3da9e0bfaaef792e5eb2d9419d8ed3d

    • SSDEEP

      1536:vKQj+0uJJEVGakj3b0wl+60U7CPIWMiFI3WEf3h6QzxjeRQrnRVRoRch1dROrwp+:SQC0uJJEVGamrrl/NHWPEfR6QIerTWMa

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks